Server-Side Request Forgery and Path Traversal Vulnerability in Apache Camel
CVE-2026-78163

5.9MEDIUM

Key Information:

Vendor: Apache
Status: Apache Camel
Vendor: CVE Published:; 19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-78163?

A Server-Side Request Forgery (SSRF) and path traversal vulnerability exists in the Apache Camel Docling component. When processing string message bodies, the component's behavior is determined by the prefix of the input string. This misinterpretation allows unintended access to remote resources or the local filesystem. Without proper checks in place, unauthorized access to sensitive information can occur. Users are advised to upgrade to version 4.23.0 or later to rectify this issue, and those on specific older versions should follow the recommended update paths to mitigate the risk of exploitation.

Affected Version(s)

Apache Camel 4.15.0 < 4.18.5

Apache Camel 4.19.0 < 4.22.1

Apache Camel 4.18.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-78163
Created by oscerd